The BB84 QBC protocol by Bennett and Brassard [1] is quite similar to the well-known BB84 QKD protocol:
b | bi | qubit sent | measurement basis | P(0 measured) | P(1 measured) | |
0 | 0 | 0 | 1 | 0 | ||
0 | 0 | 1 | ||||
0 | 1 | 0 | 0 | 1 | ||
0 | 1 | 1 | ||||
1 | 0 | 0 | ||||
1 | 0 | 1 | 1 | 0 | ||
1 | 1 | 0 | ||||
1 | 1 | 1 | 0 | 1 |
Here b is hidden in the basis, either horizontal or rotated by 45 degrees. Alice is sending a mixture of orthogonal states to confuse Bob, who can not tell whether is receiving mixed 's and 's or mixed 's and 's. It all will make sense, however, when the list of initial polarizations is sent: he will have measured 50% of the particles with the correct basis, providing a certain measure. If any of those turns out to be incorrect, he will know that cheating was involved.
Before the disclosure takes place, B gains no information at all from
the protocol, as illustrated by table 1. He could try to cheat by
using any arbitrary basis, but whatever measurements he does, the randomness
of
implies that he cannot guess the value of b before
the disclosure phase (table 2).
b | bi | qubit sent | measurement basis | P(0 measured) | P(1 measured) |
0 | 0 | ||||
0 | 1 | ||||
1 | 0 | ||||
1 | 1 |
When A reveals the list of , B is able to confirm that indeed all his measurements gave the right value for the approximately times that bi was equal to .
Also, A cannot cheat, for table 3 suggests that whatever she sends will have a probability equal to of being caught if she tries to make believe it was a zero, and of if she tries to make believe it was a one (when it happens to be measured with the aligned basis). The only way to be certain that B will accept the protocol is to either make by sending and committing to zero or make by sending and committing to one.
qubit sent | measurement basis | P(0 measured) | P(1 measured) | |
0 | ||||
1 |
If A would be willing to take risks, she would face a situation as in
figure 2, where we have set
4. With
for example, the probability of error is
for both measurements, so A would not be caught with
a probability of
which rapidly approaches zero when
the protocol is done with a sufficiently large number s of iterations.
This protocol looks as secure as Quantum Key Distribution, at a first glance. It does have a failure, however, as Bennett and Brassard realized from the beginning.